search

google / certificate-transparency-go

Auditing for TLS certificates (Go code)
https://certificate.transparency.dev
Apache License 2.0
903 stars 232 forks source link

Safeguard against redirects on PUT request #1418

Closed mhutchinson closed 6 months ago

mhutchinson commented 6 months ago

A redirect on a PUT request will make the http client perform a GET request to the signposted URL. This will (probably) return a 200, which the code will then interpret as a successful PUT. This check ensures that the method the response relates to is the same as the one we invoked.

mhutchinson commented 6 months ago

Worth adding a comment linking to/quoting https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections#permanent_redirections ?

Done